Commit 8f9abaa6 authored by Naveen N Rao's avatar Naveen N Rao Committed by Michael Ellerman
Browse files

powerpc/lib: Validate size for vector operations 



Some of the fp/vmx code in sstep.c assume a certain maximum size for the
instructions being emulated. The size of those operations however is
determined separately in analyse_instr().

Add a check to validate the assumption on the maximum size of the
operations, so as to prevent any unintended kernel stack corruption.

Signed-off-by: default avatarNaveen N Rao <naveen@kernel.org>
Reviewed-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
Build-tested-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20231123071705.397625-1-naveen@kernel.org
parent df99da19

arch/powerpc/lib/sstep.c

+10 −0
Original line number Diff line number Diff line
@@ -586,6 +586,8 @@ static int do_fp_load(struct instruction_op *op, unsigned long ea, 
	} u;



	nb = GETSIZE(op->type);

	if (nb > sizeof(u))

		return -EINVAL;

	if (!address_ok(regs, ea, nb))

		return -EFAULT;

	rn = op->reg;
@@ -636,6 +638,8 @@ static int do_fp_store(struct instruction_op *op, unsigned long ea, 
	} u;



	nb = GETSIZE(op->type);

	if (nb > sizeof(u))

		return -EINVAL;

	if (!address_ok(regs, ea, nb))

		return -EFAULT;

	rn = op->reg;
@@ -680,6 +684,9 @@ static nokprobe_inline int do_vec_load(int rn, unsigned long ea, 
		u8 b[sizeof(__vector128)];

	} u = {};



	if (size > sizeof(u))

		return -EINVAL;



	if (!address_ok(regs, ea & ~0xfUL, 16))

		return -EFAULT;

	/* align to multiple of size */
@@ -707,6 +714,9 @@ static nokprobe_inline int do_vec_store(int rn, unsigned long ea, 
		u8 b[sizeof(__vector128)];

	} u;



	if (size > sizeof(u))

		return -EINVAL;



	if (!address_ok(regs, ea & ~0xfUL, 16))

		return -EFAULT;

	/* align to multiple of size */